CVE-2026-54280

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-404"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54280.json"
}

References

Affected packages

Git / github.com/aio-libs/aiohttp

Affected ranges

Type

GIT

Repo

https://github.com/aio-libs/aiohttp

Events

Introduced

152e4160fde8985e770398da5271396d7a831198

Fixed

9c35d03aa5fecd294510196e07f176f1a2e7fa33

Fixed

a762eda5242f6490d6ba667533193f8b473ad587

Database specific

Show details

{
    "cpe": "cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.12.1"
        },
        {
            "fixed": "3.14.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54280.json"